BSOD 108 (REFMON_INITIALIZATION_FAILED): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The reference monitor failed during early security initialization.

Could be also:
Constant	Type	OS
ERROR_DRIVE_LOCKED	Win32 error	Windows
ESHUTDOWN	errno	Linux
ECONNRESET	errno	Windows

Previous	Next
PROCESS1_INITIALIZATION_FAILED	SESSION1_INITIALIZATION_FAILED

REFMON_INITIALIZATION_FAILED

Reference monitor initialization failure for REFMON_INITIALIZATION_FAILED

REFMON_INITIALIZATION_FAILED is bug check code 0x0000006C. The reference monitor enforces access checks and security decisions in the kernel. This bug check indicates that this security enforcement component could not initialize consistently during boot.

How to read it in a dump

The failure is boot-time security infrastructure, not a single denied access check.
Nested status codes, security descriptors, token setup, and early security callbacks are relevant.
Security products or system file corruption can be involved if visible in the dump.

What to check

Check early-loaded security products and kernel callbacks.
Verify system files and security policy registry state.
Compare with SECURITY_INITIALIZATION_FAILED and SECURITY1_INITIALIZATION_FAILED.

References

Dump evidence

Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “this result”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order

Run WinDbg !analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line.
find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with refmon / initialization.
keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.